Programs ◫
Active ▶
Findings ◆
By Severity
Crit
High
Med
Low

Recent Tasks

No tasks yet

🔵 Sincronizar YesWeHack

⚠ YWH rate-limita la IP de la VPS tras un puñado de peticiones (se resetea en ~10–30 min pero vuelve a bloquear en cuanto aumenta el ritmo). Además, el JWT se ancla a la IP que lo emitió, así que programas privados y reports siempre darán 401 desde aquí.

Recomendado: extensión Chrome v0.2.0 — hace el sync desde tu navegador con tu IP residencial y tu sesión real:
  1. Config → Extension → Descarga el .zip
  2. chrome://extensions → Load unpacked (o recarga 🔄 si ya la tienes — asegúrate versión 0.2.0)
  3. Pulsa el icono de la extensión → expande ⚙ Sync YesWeHack from my browser → Start YWH sync
🆕 bbscope (login con email/password — funciona desde el server)
Login completo con email+password. El JWT se emite desde la IP del server, así no hay mismatch. Recomendado si tienes muchos privados.

⚠ Tienen que ser exactamente 6 dígitos

El seed BASE32 del QR (no el código de 6 dígitos). Si lo pegas, regeneramos códigos frescos por cada pase y la visibility se clasifica bien.

¿No tienes el TOTP secret BASE32? Sincroniza reports aparte con un código fresco de 6 dígitos:

(Bloque legacy — sólo se puede usar desde una IP no bloqueada por YWH.) JWT YesWeHack para sincronizar programas y reports:

Cópialo de DevTools → Application → Cookies → jwt-token en yeswehack.com

Open program page
No active session — the next task starts one
Platform: Bounty: Visibility: Recon:

💬 Program Session

Name
UUID
last used
No session yet. Launch a task (Hunt, Recon…) and this program's single Claude session will be created and bound here — resumable and renamable.

Test Accounts

These credentials are automatically injected into every task for this program.

No test accounts yet. Create disposable TempMail addresses to use in multi-account testing (IDOR, privilege escalation, account isolation).

Custom Context ()

No custom context yet. Add URLs, notes, headers, or any program-specific information that agents should know about.

🔐 Browser Session Handoff ACTIVE · NOT SET

For programs where TempMail signup doesn't work (banks, KYC, enterprise), log in manually with a real browser, paste the cookies + JWT here, and /hunt will use them as auth for every curl. Without this, /hunt falls back to unauthenticated probes — much shallower coverage.
Primary URL:
File · bytes
The exact URL you're auditing (path + query). /hunt will treat the params here as the primary attack surface.
Raw JWT also accepted — `Bearer ` prefix added automatically.
Saved as hunts/browser-session-latest.md — read by /hunt's Phase -1.

In-Scope Assets ()

No scope data

Discovered Hosts ()

Findings ()

No reportable findings yet
🔵

YesWeHack Reports ()

Local Reports ()

Task History ()

No tasks executed on this program yet

Key Rules

Create Program

# Program Platform Bounty Scopes Vis Type
No programs match your filters

Tasks

No tasks yet No matching tasks
turno · $
Sin programas que coincidan
cargando contexto…
Elige un programa para abrir una sesión interactiva.
Escribes tú los comandos (texto libre o /hunt, /deep…) y Kea los ejecuta en el contexto de ese programa.
Sin mensajes todavía. Escribe abajo para empezar.
🦜 Kea turno

💬 Sessions

One Claude session (UUID) per program. Rename it, resume it with a follow-up, or reset it to start fresh.

No sessions yet. Launch a task on any program to create one.
Program Name UUID Last used Follow-up
nuevas sin leer
selected
j/k navegar · enter abrir · / buscar · 1-4 sev · f favorito · esc cerrar
📭
Sin findings con esos filtros

🤖 Subagents

Registro de los subagentes de Kea — cada uno vive en agents/<name>.md y se invoca con la tool Task() desde Claude Code.

agents
Sin agentes que coincidan con \"\".
No se han cargado agentes — comprueba que existe el directorio agents/.

Creates 2 disposable TempMail addresses

Account A (victim) + Account B (attacker). Credentials are saved to hunts/accounts.md and automatically injected into every task for the selected program.

🧠 Long-term program investment

Builds deep expertise on the program across sessions. Maps every feature, workflow, and role. Hunts exclusively logic bugs (workflow bypass, state machine abuse, price manipulation, race conditions) that no scanner can find.

Auto-resumes from last session. Each run makes the next one smarter.

🧠 Specialize

Deep app understanding — maps features, workflows, roles, business logic. Classifies each vuln class as POSSIBLE/UNLIKELY/IMPOSSIBLE. Identifies unique attack surface. Saved as context for all future hunts.

Source Code Audit

Clones a repo and performs deep static analysis — injection, auth bypass, IDOR, SSRF, path traversal, deserialization, hardcoded secrets.

⚠ CVE Hunter

Fingerprints the stack, enumerates CVEs affecting detected products via vulnx MCP (ProjectDiscovery vulnerability.sh), prioritizes KEV + working PoC + CVSS, and validates candidates with safe probes (nuclei templates, blind OOB via Interactsh). Saves only confirmed exploitable findings.

Accepts: target.com | CVE-YYYY-NNNNN (lookup only) | product:version

Mobile App Analysis

Downloads, decompiles and audits APK/IPA for hardcoded secrets, exported components, insecure configs, and code-level vulnerabilities.

Installs APK in headless Android emulator, drives the app via mobile-mcp, captures HTTP/HTTPS traffic with mitmproxy, and reviews the live API for IDOR/auth/business-logic issues.

⚠ Play Store only? Give a package name → agent downloads APK automatically (apkpure/apkmirror). Or upload the APK manually to /tmp/ and pass the path.

This program's single session is always resumed
Every task on a program continues the same Claude session (same UUID). To start over, use Reset in the program's session panel or the Sessions tab.